Skip to content

[PR] ci(#4828): kernel-guard exempts lockfile-only churn from the human gate #4837

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ranxianglei merged 1 commit into from
Oct 26, 2026
+9 −2
Merged

[PR] ci(#4828): kernel-guard exempts lockfile-only churn from the human gate #4837

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -430,9 +430,16 @@ jobs:
exit 0
fi
# Rule 1: any PR touching kernel/** must declare 'kernel-change:' in its body.
if git diff --name-only origin/master...HEAD -- kernel/ | grep -q .; then
# #4828: kernel/package-lock.json is GENERATED state, not kernel source —
# agents' test-prep installs churn it without any intent to change the
# kernel (8 PRs tripped this gate on lockfile-only diffs). The human gate
# protects kernel SOURCE; lockfile consistency is already enforced by the
# separate lock-sync job (which FAILS on real drift). Exempt the lockfile
# here so pure churn passes without an owner round-trip.
KERNEL_TOUCHED="$(git diff --name-only origin/master...HEAD -- kernel/ | grep -v '^kernel/package-lock\.json$' || true)"
if [[ -n "$KERNEL_TOUCHED" ]]; then
if ! printf '%s' "$PR_BODY" | grep -q 'kernel-change:'; then
echo "::error::This PR modifies kernel/ but does not declare 'kernel-change: <reason>' in its body."
echo "::error::This PR modifies kernel/ ($KERNEL_TOUCHED) but does not declare 'kernel-change: <reason>' in its body."
echo "Kernel changes are human-gated: owner approval plus explicit declaration required. See AGENTS.md 'Kernel Boundary'."
exit 1
fi
Expand Down
Loading